Tunnel interface for securing traffic over a network

ABSTRACT

A flexible, scalable hardware and software platform that allows a service provider to easily provide internet services, virtual private network services, firewall services, etc., to a plurality of customers. One aspect provides a method and system for delivering security services. This includes connecting a plurality of processors in a ring configuration within a first processing system, establishing a secure connection between the processors in the ring configuration across an internet protocol (IP) connection to a second processing system to form a tunnel, and providing both router services and host services for a customer using the plurality of processors in the ring configuration and using the second processing system. A secure communications tunnel is formed by routing all packets for the tunnel through an encrypting router at the sending end to obtain encrypted packets, and routing the encrypted packets through a decrypting router at the receiving end of an IP connection.

CROSS-REFERENCES TO RELATED INVENTIONS

[0001] This application claims the benefit under 35 U.S.C. 119(e) ofU.S. Provisional Application Serial No. 60/232,516 filed Sep. 13, 2000and U.S. Provisional Application Serial No. 60/232,577 filed Sep. 13,2000, both of which are incorporated by reference.

FIELD OF THE INVENTION

[0002] This invention relates to the field of internet processors, andmore specifically to a method and apparatus of delivering securityservices such as firewalls.

BACKGROUND OF THE INVENTION

[0003] The service provider game has grown extremely crowded andfiercely competitive, with numerous players offering similar productsand services. While having a large number of comparable services isarguably beneficial to the enterprise, it poses a host of potentiallydisastrous consequences for a service provider. If all competitors in agiven market are offering services that are indistinguishable by thecustomer base, the burden of differentiation falls squarely on cost,with the least-cost competitor emerging “victorious”. Jockeying for thecost-leader position rapidly drives down service pricing, reducingmargins to rubble and rendering the service a commodity. Furthermore,numerous offerings that are similar in attributes and cost make it verydifficult to lock in customers.

[0004] Operational costs also present a significant challenge to serviceproviders. Cumbersome, manual provisioning processes are the primaryculprits. Customer orders must be manually entered and processed throughnumerous antiquated back-end systems that have been pieced together.Once the order has been processed, a truck roll is required for onsiteinstallation and configuration of Customer Premises Equipment (CPE), aswell as subsequent troubleshooting tasks. This is a slow and expensiveprocess that cuts into margins and forces significant up-front chargesto be imposed on the customer. In order to be successful in today'smarket, service providers must leverage the public network to offerhigh-value, differentiated services that maximize margins whilecontrolling capital and operational costs. These services must berapidly provisioned and centrally managed so that time-to-market and,more importantly, time-to-revenue are minimized. Traditional methods ofdata network service creation, deployment, and management presentsignificant challenges to accomplishing these goals, calling for a newnetwork service model to be implemented.

[0005] Basic Internet access, a staple of service provider offerings,has been commoditized to the point that margins are nearly non-existent.This fact has driven service providers to look for new value-addedfeatures and services to layer over basic connectivity so that they areable to differentiate on factors other than cost. The most significantopportunity for differentiation is found in managed network services.Managed network services enable enterprise IT organizations to outsourcetime-consuming tactical functions so that they can focus strategic corebusiness initiatives.

[0006] Enterprise customers are now demanding cost-effective, outsourcedconnectivity and security services, such as Virtual Private Networks(VPNs) and managed firewall services. Enterprise networks are no longersegregated from the outside world; IT managers are facing mountingpressure to connect disparate business units, satellite sites, businesspartners, and suppliers to their corporate network, and then to theInternet. This raises a multitude of security concerns that are oftenbeyond the core competencies of enterprise IT departments. To compoundthe problem, skilled IT talent is an extremely scarce resource. Serviceproviders, with expert staff and world-class technology and facilities,are well positioned to deliver these services to enterprise customers.

[0007] While IT managers clearly see the value in utilizing managednetwork services, there are still barriers to adoption. Perhaps the mostsignificant of these is the fear of losing control of the network to theservice provider. In order to ease this fear, a successful managednetwork service offering must provide comprehensive visibility to thecustomer, enabling them to view configurations and performancestatistics, as well as to request updates and changes. Providing ITmanagers with powerful Customer Network Management (CNM) tools bolstersconfidence in the managed network service provider and can actuallystreamline the service provisioning and maintenance cycle.

[0008] Customer Premises Equipment (CPE)-Based Managed Firewall Services

[0009] Data network service providers have traditionally rolled outmanaged network service offerings by deploying specialized CPE devicesat the customer site. This CPE is either a purpose-built networkappliance that, in addition to providing specific service features, mayalso serve some routing function, or a mid to high-end enterprise-classserver platform, typically UNIX-based. In the case of a managed firewallsolution, the CPE device provides services that may include VPN tunneltermination, encryption, packet filtering, access control listings, andlog files. The CPE at each customer site is aggregated at a multiplexervia leased lines and/or public Frame Relay PVCs (permanent virtualcircuits) at the service provider POP (point of presence), then into ahigh-end access router and across the WAN (wide area network).

[0010] In many cases, service providers and enterprise customers find ittoo expensive and cumbersome to deploy CPE-based security at every site,but rather deploy secure Internet access points at one or two of thelargest corporate sites. In this model, all remote site Internet trafficis backhauled across the WAN to the secure access point and then outonto the Internet, resulting in increased traffic on the corporatenetwork and performance sacrifices.

[0011] Service providers face significant challenges when deploying,managing and maintaining CPE-based managed firewall services. When acustomer expresses interest in utilizing such a service, a consultationwith experienced security professionals is required to understand thecorporate network infrastructure and site-specific securityrequirements, yielding a complex set of security policies. This may beaccomplished through a set of conference calls or a number of on-sitevisits. Once the security requirements and policies have beenidentified, the service provider must procure the CPE device. In somecases, the equipment vendor may provide some level of pre-configurationbased upon parameters supplied by the service provider. While CPEvendors are driving towards delivering fully templatized, pre-configuredsystems that are plug-and-play by enterprise staff, most serviceproviders still assume the responsibility for on-site, hands-onconfiguration, and a truck-roll to each of the customer sites isnecessary. This is particularly true in server-based CPE systems, wherea relatively high degree of technical sophistication and expertise isrequired to install and configure a UNIX-based system.

[0012] Typically, a mid-level hardware and security specialist is sentonsite, along with an account manager, to complete the CPE installationand configuration. This specialist may be a service provider employee ora systems integrator/Value-Added Reseller (VAR) who has been contractedby the service provider to complete CPE rollout. This complex processbegins with physical integration of the CPE device into the customernetwork. In the case of a CPE appliance, where the OS and firewall/VPNsoftware components have been pre-loaded, the tech can immediatelyproceed to the system configuration phase. Server-based CPE services,however, require the additional time-consuming step of loading thesystem OS and software feature sets, adding a further degree ofcomplexity.

[0013] In the configuration phase, the tech attempts to establishcontact between the CPE device and central management system at theservice provider NOC (network operations center). In cases where thedevice has not been previously assigned an IP address, an out-of-bandsignaling mechanism is required to complete the connection, typically amodem and a POTS line. If the integration process has been successful,NOC staff should be able to take over the process, pushing specificpolicy configurations (and possibly an IP address) down to the CPEdevice through a browser-driven management interface. This entireprocess must be repeated for every enterprise site utilizing themanaged-firewall service.

[0014] Additionally, maintenance processes and costs for CPE-basedmanaged firewall services can also be overwhelming to both the serviceprovider and enterprise customers. Enterprises are forced to either keepcold spares onsite or be faced with periods of absent security whentheir firewall fails, a situation that is unacceptable to most oftoday's information intensive corporations. Service providers must havean inventory of spares readily available, as well as staff resourcesthat can, if necessary, go onsite to repeat the system configurationprocess. Troubleshooting thousands of CPE devices that have beendeployed at customer sites is an extremely formidable challenge,requiring extensive call center support resources, as well techniciansthat can be quickly deployed onsite.

[0015] As CPE-based firewall services have traditionally been deployedin private enterprise networks, the original management systems forthese devices have difficulty scaling up to manage several large,multi-site service provider customers. CPE device vendors are scramblingto ramp up these systems to carrier-grade and scale. Firewall managementsystems are typically GUI-based (graphical user interface-based),browser-driven interfaces that run on industrial grade UNIX platforms inthe service provider NOC. The management system interfaces with the CPEdevices based on IP address. The CPE-based managed firewall model facesservice providers with another issue: capital costs. In addition to thesignificant costs required to build out a POP/access infrastructure,including multiplexers and high-capacity access routers, the serviceprovider must also assume the initial costs of the CPE device, includingfirewall and VPN software licensing charges. In many cases, these costsare passed on to the customer. This creates steep up-front costs that,coupled with per-site installation charges, can present a seriousbarrier to service adoption. In markets where several service providersare offering managed firewall services, a service provider may absorbthe CPE cost to obtain a price leadership position, cutting deeply intomargins.

[0016] The CPE-based model is also limited when rolling out servicesbeyond the managed firewall offering. New services, such as intrusiondetection, may require additional hardware and/or software. This resultsin higher capital costs, as well as another expensive truck roll.

[0017] There is also a performance penalty in conventional IP-SEC-mode(internet protocol secure mode) transmissions, in that each packet goingthrough must be examined at the sending end of a transmission todetermine whether it must be encrypted, and then each packet at thereceiving end of the transmission to determine whether it must bedecrypted.

[0018] Thus, there is a need for a method and apparatus of delivering avariety of network services, for example security services such asfirewalls and secure transmission of date across a network such as theinternet.

SUMMARY OF THE INVENTION

[0019] The present invention provides a flexible, scalable hardware andsoftware platform that allows a service provider to easily provideinternet services, virtual private network services, firewall services,etc., to a plurality of customers. This solution can be changes toprovision each customer with more or less processing power and storage,according to individual changing needs.

BRIEF DESCRIPTION OF THE DRAWINGS

[0020]FIG. 1 is a block diagram of one embodiment of the presentinvention, system 100 having a plurality of ISP boxes 110 connected tothe internet 99

[0021]FIG. 2 is a block diagram of one embodiment of the presentinvention, service provider network 200.

[0022]FIG. 3 is a block diagram of one embodiment of the presentinvention, an IP service delivery platform 300.

[0023]FIG. 4 is a block diagram of one embodiment of the presentinvention, a system 400 providing a plurality of virtual privatenetworks 410, 420, 430, 440.

[0024]FIG. 5 is a block diagram of one embodiment of the presentinvention, a ring-network hardware platform 230.

[0025]FIG. 6 is a block diagram of one embodiment of the presentinvention, service processing switch 600.

[0026]FIG. 7 is a block diagram of one embodiment of the presentinvention, an integrated system 700 including conventional existingnetwork elements.

[0027]FIG. 8 is a block diagram of one embodiment of the presentinvention, hardware elements 230 and software elements 220.

[0028]FIG. 9 is a block diagram of one embodiment of the presentinvention, multiprocessor system 900 using ring network 932.

[0029]FIG. 10 shows a block diagram of a system 1000 for comparison.

[0030]FIG. 11 shows a block diagram of a system 1100 for comparison.

[0031]FIG. 12 shows a block diagram of a system 1200 for comparison.

[0032]FIG. 13 shows a block diagram of a system 1300 for comparison.

[0033]FIG. 14 shows a block diagram of one embodiment of the presentinvention, system 1400.

[0034]FIG. 15 shows a block diagram of one embodiment of the presentinvention, system 1500.

DESCRIPTION OF PREFERRED EMBODIMENTS

[0035] In the following detailed description of the preferredembodiments, reference is made to the accompanying drawings that form apart hereof, and in which are shown by way of illustration specificembodiments in which the invention may be practiced. It is understoodthat other embodiments may be utilized and structural changes may bemade without departing from the scope of the present invention.

[0036] The leading digit(s) of reference numbers appearing in theFigures generally corresponds to the Figure number in which thatcomponent is first introduced, such that the same reference number isused throughout to refer to an identical component which appears inmultiple Figures. Signals and connections may be referred to by the samereference number or label, and the actual meaning will be clear from itsuse in the context of the description.

[0037] In some embodiments, the present invention deploys one or morevirtual private networks (VPNs) running on one or more carrier-classplatforms that scale to provide cost-effective solutions for internetservice providers (ISPs). In particular, security services such asfirewalls can be provided by the ISPs for services they provide to theircustomers, wherein a plurality of customers are hosted on a singlenetwork of processors. An ISP is providing hosting services (e.g.,hosting an internet web site for a customer) and routing (moving data toand from the internet) for their customers.

[0038]FIG. 1 shows one embodiment of the present invention having asystem 100 that includes a plurality of similar ISP (internet serviceprovider) boxes 110 connected to the internet 99. In this embodiment,each box 110 represents a subsystem having routing services provided bya block called access router 111, and hosting services provided byblocks 113 and 114. The ISP is typically a company that providesinternet services (such as connectivity to the internet, as well asservers that store data and provide data according to requests by users,and network connectivity to users) to a plurality of customers includingcustomer A and customer B. In some embodiments, customer premisesequipment 117 and 118 (also called CPE 117 and 118, this is hardware andthe software that controls the hardware, that is installed at thecustomer's premises; this can include servers, routers and switches, andthe network connecting to individual user's workstations, and variousinterfaces to external communications networks) is used to provide atleast a portion of the function to support customers A and Brespectively, and the ISP 110 provides the rest in blocks 113 and 114respectively. The function to support customers includes such things asweb site hosting, database and other servers, e-mail services, etc. Thecustomer's CPE 117 and 118 connect to the ISP through, e.g., accessrouter 111 and security services 112 to customer A site one 113 andcustomer B site one 114, and also to the internet 99 in a manner thatisolates customer A and customer B from one another except forcommunications and E-mail that would normally pass across the internet99.

[0039] Further, by establishing secure connections between two ISP boxes110 across the internet 99, a virtual private network or VPN 410 (seeFIG. 4 below) can be created. This function allows, for example,customer A's office at a first site (e.g., headquarters 117) to connectseamlessly to customer A's office at a second site (e.g., branch office119) using what appears to them as a private network, but which actuallyincludes some CPE at site 117, some services 113 provided within ISP110.1, a secure encrypted connection across internet 99, some servicesalso in ISP 110.2, and some CPE at site 119. Users at sites 117 and 119can communicate with one another and share data and servers as if theywere on a single private network provided by, e.g., VPN 410.

[0040]FIG. 2 is a block diagram of one embodiment of the presentinvention, service provider (SP) network 200. A conventional network“cloud” 98 includes the SP's internet protocol (IP) or asynchronoustransfer mode (ATM) core, as is well known in the internet art. IPsystem 201 connects to such existing infrastructure 98, as well as toother optional conventional hardware such as described in FIG. 2 below,to provide SP network 200. IP System 201 provides hardware 230 andsoftware 220 to provide a plurality of virtual routers (VRs) 210. EachVR 210 provides support for router services and server services such asthose that provide customer site services 113 of FIG. 1. Each VR 210 issupported by an object group 211, which is a group of generallydissimilar objects such as routing object 212, packet filtering object213, firewall object 212, network address translation (NAT) object 215,and/or other objects. In some embodiments, each VR 210 is a separateinstantiation.

[0041] In some embodiments, software 220 includes IP network operatingsystem (IPNOS) 223, service management system (SMS) 221 (e.g., in someembodiments, this is the Invision™ software from CoSine CommunicationsInc., assignee of the present invention), and customer networkmanagement system (CNMS) 222 (e.g., in some embodiments, this is theIngage™ software from CoSine Communications Inc., assignee of thepresent invention). SMS 221 provides such services as configuration ofblades 239, defining subscribers, determining services, and generationof IP security (IPSec) public/private key pairs. CNMS 222 provides suchservices as providing subscribers (customers) visibility to services. Insome embodiments, CNMS software runs at least in part in a user's CPE orworkstation, typically at a company's information services (IS)headquarters.

[0042] In some embodiments, IP server switch (IPSX) hardware 230includes one or more scalable hardware enclosures, each having aplurality of service “blades” 239 (i.e., an insertable and removableprinted circuit card having one or more processors, each having its ownCPU and memory) each connected in a ring configuration (such as acounter-rotating dual ring 232). In some embodiments, three types ofblades 239 are provided: control blade(s) 234, processor blade(s) 236,and access blade(s) 238. IPSX hardware also includes highly available,redundant, and hot-swappable hardware support 240 including powersupplies 241 and fans 242.

[0043]FIG. 3 is a block diagram of one embodiment of the presentinvention, an IP service delivery platform (IPSDP) 300. The hardware andsoftware of SP network 200 can be viewed as generating various network“clouds” such as edge cloud 95, access concentration cloud 96, andservice processing cloud 97. These are built upon the existingconventional SP's IP or ATM core cloud 98 and they connect to theexternal internet cloud 99. IPSDP 300 includes an ISP's SP network 200connected to one or more customer's offices 301 each of which includessome amount of CPE 110. In the embodiment shown, three corporate remoteoffices 301.1 are connected to SP network 200 using various conventionalcommunications devices, well known to the art, such as frame relayswitch 326, M13 multiplexor (mux) 327, DSLAM (digital subscriber linkaccess multiplexor) 328, and dial-up RAS (remote access server) 329(used to receive dial-up connections, for example, from the modem 311connected to laptop computer 316 in portable system 310 of dial-uptelecommuter 301.3). In the embodiment shown, SP network 200 includestwo systems 201, on connecting through frame relay switch 326, M13multiplexor (mux) 327, DSLAM 328, and dial-up RAS 329 to remote office'sCPE 110, and the other connecting directly to the customer's corporateheadquarter's CPE 1110 (which also includes a control and monitoringfunction provided by CNMS 222) using conventional communicationsprotocols such as frame relay (FR, an access standard defined by theITU-T in the 1.122 recommendation “Framework for Providing AdditionalPacket Mode Bearer Services”), internet protocol (IP), FT1 (fractionalT1), T1/E1 (a digital transmission link with capacity of 1.544 Megabitsper second), FT3 (fractional T3), T3 (capacity of 28 T1 lines), and/orOC3 (optical carrier level 3=three times the OC1 rate of 51.840Mbps)(each of which is a conventional communications service well knownto the art).

[0044] In some embodiments, IPDSP 300 provides a VPN 410, using secureconnections across the internet 99, to connect remote offices 301 to oneanother.

[0045]FIG. 4 is a block diagram of one embodiment of the presentinvention, a system 400 providing a plurality of virtual privatenetworks 410, 420, 430, 440. VPNs 420, 430, and 440 are each equivalentto the VPN 410 that supports subscriber 1, except that they are forother subscribers. Each subscriber has a set of partitioned virtualrouters 210. For example, subscriber 1 has two locations, 411 and 412,connected in a VPN 410. VR 210 at location 411 can include some CPE 110as well as support provided in system 201-1. VR 210 at location 412 caninclude some CPE 110 as well as support provided in system 201-2. Thesetwo VRs 210 establish a “tunnel,” a secure connection, that allows themto maintain secure communications that support the VPN 410 even acrosspacket networks such as the internet 99. Each VR 210 is the equivalentof an independent hardware router. Since each VR 410 is supported by anobject group 211, objects can be easily added or omitted to enablecustomized services on a subscriber-by-subscriber basis to meet eachsubscribers individual needs. SMS 221 running on SP network 200 allowsease of service provisioning (dynamically adding additionalprocessors/processing power when needed, reducing theprocessors/processing power used for VPN 410 when not needed). In someembodiments, IPNOS 223 uses an open Application Program Interface (API)to enable new services to be added to the platform whenever needed.

[0046] In some embodiments, system 401 at a first site (e.g., an ISPpremises locally connected to a customer office) includes IPSX 201-1having a VR 210 connected to CPE 117. This system 401 appears to theoutside world as a single router having firewall services, server(s) anduser(s), etc. These functions can be provided by either or both VR 210and CPE 117, thus allowing a customer to outsource many or most of theseservices to the service provider and IPSX 201-1. Similarly, system 402at a second site (e.g., another ISP premises locally connected to aremote office of the same customer) includes IPSX 201-2 having a VR 210connected to CPE 119. This system 402 also appears to the outside worldas a single router having firewall services, server(s) and user(s), etc.These functions can be provided by either or both VR 210 and CPE 119,thus allowing a customer to outsource many or most of these services tothe service provider and IPSX 201-2.

[0047]FIG. 5 is a block diagram of one embodiment of the presentinvention, a ring-network hardware platform 230. Hardware platform 230includes plurality of service “blades” 239 (i.e., an insertable andremovable printed circuit card having one or more processors, eachhaving its own CPU and memory) each connected in a ring configuration(such as a counter-rotating dual ring 232). In some embodiments, threetypes of blades 239 are provided: control blade 234 (not shown here),processor blades 236 (providing such functions as point-to-point (PPTP)connectivity, firewall protection against hacking, intruders, oraccidental access), and access blades 238 (providing such functions asNAT, encryption, and routing).

[0048]FIG. 6 is a block diagram of one embodiment of the presentinvention, service processing switch 600. In some embodiments, serviceprocessing switch 600 includes a hardware enclosure 230 having powersupplies 241 that are hot-swappable, redundant, capable of automaticfailover (when one fails, others take over), and which can be AC or DCsourced. In some embodiments, dual hot-swappable, variable speed fans242 are provided. In some embodiments, software updates can be madewithout system downtime by swapping out all object groups 211 (virtualrouters), changing the software modules, and then resuming processing.In some embodiments, all service blades 239 are hot-swappable (they canbe removed and/or inserted without bringing the system down) and includeautomatic failover from primary mode to protect mode. In someembodiments, dual counter-rotating rings 232 support primary and protectredundancy. In some embodiments, system 600 provides NEBS Level 3compliance and is Y2K ready, provides SONET (synchronous opticalnetwork) 1+1 Line Protection Switching, and includes integrated metalliccross-connects to enable DS3 (digital signal level 3; 44,736,000 bitsper second) blade automatic failover without touching the facility.

[0049]FIG. 7 is a block diagram of one embodiment of the presentinvention, an integrated system 700 including conventional existingnetwork elements. Integrated system 700 optionally includes conventionalframe relay switch 326, M13 mux 327, DSLAM (DIGITAL SUBSCRIBER LINKACCESS MULTIPLEXOR) 328, and RAS (REMOTE ACCESS SERVER) 329 connectingto customer's equipment such as CPE router 110 and dial-up system 310.In some embodiments, integrated system 700 optionally includes a core IProuter 720 and/or a core ATM switch as part of an SP core 98. Thisprovides support for a large number of conventional technologystandards, and interoperability with existing access-concentration andcore-network elements. It also offers interworking between frame-relaynetworks and IP networks. Network address translation (NAT) enablesenterprise subscribers to leave their network addressing untouched. Italso enables one to merge IP and legacy networks into one, withcontinuity of service (COS) guarantees.

[0050]FIG. 8 is a block diagram of one embodiment of the presentinvention, hardware elements 230 and software elements 220. Hardwareelements 230 include a 26-slot, two-sided chassis 831 having a22-gigabit per second (Gbps) ring midplane 832. Service blades 239 canbe hot plugged into midplane 832 form either side of chassis 831. Threetypes of service blades 239 are provided: control blades 234, processorblades 236, and access blades 238. In some embodiments, four processorsare provided on each service blade 239, each processor having a CPU andits own memory, allowing specialized processing to be performed onvarious different daughter cards of the blades 239.

[0051] In some embodiments, a single system chassis 831 provides aredundant back plane and blade-termination facilities 832. The accessblades 238, processor blades 236, control blades 234, power supplies 241and fan trays 242 are designed for hot-swappable operation—any of thesecomponents may be removed from service while the entire system remainsoperational. The metallic cross connect is a passive system thatprovides fail-over support to allow DS3 and DS1 access facilities to beswitched from one access blade to another access blade should an accessport or card fail. The phase 1 chassis provides 26 universal slots, eachof which may be populated with control blades, access blades, andprocessor blades. To operate, the chassis must contain at least onecontrol blade. Up to two control blades may be operational in a chassisat the same time. Access blades are added as input/output requirementsgrow, and processor blades are added as computation requirements scale.

[0052] In some embodiments, each system 230 supports up to twenty-fiveprocessing blades (PB) 236. Each processor blade 236 is designed tosupport three hundred Mbps of full duplex traffic while delivering IPservices including application firewall, LT2P, PPTP, NAT, VPN router.

[0053] In some embodiments, each system 230 supports up to two controlblades (CB) 234. CBs 234 provide overall system supervision, IP routecalculation, software update management, and network managementstatistics logging services. When two CBs 234 are operational within achassis 831, they remain synchronized such that should either CB 234fail, the other CB 234 automatically takes over system operation. Inthis process all active services remain in progress. Each control blade234 is hot swappable, so that when proper procedures are followed, afailed or malfunctioning CB 234 may be removed from on operationalsystem 230 without bringing down any customer services.

[0054] In some embodiments, each CB 234 provides four ethernetinterfaces for management traffic. Each ethernet interface has adistinct collision domain and may each be configured with a primary andsecondary IP address. Ethernet interfaces designated for management usemay be configured for primary and protected configurations, both sharingthe same IP address, reducing ISP IP address requirements. The CB 234ethernet interfaces may be configured for fully meshed communicationsover diverse paths to diverse operating systems. Each CB 234 is alsoequipped with a random # seed generator for use in securityapplications.

[0055] In some embodiments, each system 230 supports up to twenty-fiveaccess blades (AB) 238. Access blades 238 provide physical linetermination, hardware-assisted IP forwarding, hardware assistedencryption services, and hardware assisted queue management. Each accessblade 238 is hot swappable, so that when proper procedures are followed,a failed or malfunctioning ab may be removed from on operational system230 without bringing down any customer services. In some embodiments,10/100 ethernet-, DS3-, and OC3-type access blades are supported bysystem 230.

[0056]FIG. 9 is a block diagram of one embodiment of the presentinvention, multiprocessor system 900 using ring network 932. In someembodiments, each of two network rings 933 and 934 connect nodes 931together, where each blade 239 includes one or more nodes 931, and eachnode 931 is connected to one or more processors 930. In someembodiments, each processor is a high-performace processor such as anR12K processor from MIPS Corporation. In one embodiment, each blade 239includes four nodes 931, each having one processor 930. Each processor930 include its own CPU (central processing unit) 935 and memory 936,and optionally includes other hardware such as routers, encryptionhardware, etc. Software tasks, in some embodiments, are split up suchthat one processor operates on one part of the data (e.g,. the Level 7processing) and another processor operates on another part of the data(e.g., the Level 3 processing). In other embodiments, the variousprocessing portions of a task all run on a single processor,multiprocessing with other tasks that share that processor. Thus, thehardware provides scalability, where low-end systems include fewprocessors that do all the work, and high-end systems include onehundred or more processors and the work is distributed among theprocessors for greater speed and throughput. In some embodiments, theplurality of processors 930 in the ring configuration includes formingdual counter rotating ring connections 933 and 934, each connecting toeach of the plurality of processors 930.

[0057] In some embodiments, a separate control ring 935 is provided,connected to all processors 930. Data passed on the control ring 935allows control communications to be passed between processors, and inparticular, allows the control blade to configure and control the otherblades in IPSX 201. In other embodiments, control ring 935 is omitted,and its function is overlaid on rings 933 and 934.

[0058] Logical Queue Identifiers

[0059] In some embodiments, rings 933 and 934 are packet-passing rings.Each packet 950 placed in the rings includes a data portion 953 and aprocessor element identifier (PEID 951) that identifies for each node931 which processor that packet is destined for, for example a 16-bitPEID that specifies one of 65526 PEs. If the PEID matches a processor onits particular node, the node 931 passes the packet to the properprocessor 930; if not, the packet is forwarded to the next node 931. Insome embodiments, each packet also includes a logical queue identifier(LQID) that identifies a software entity (for example, an object groupfor a particular VR 210) residing on that processor 930 for which thepacket is destined.

[0060] In some embodiments, every node 931 has a unique, globally unique(i.e., unique within an IPSX 201, or within an ISP having a plurality ofIPSXs 201) PEID 951. In some embodiments, the way this is done is thatone takes the blade ID (e.g., five bits) and you append the PE number,which is, for example, a eleven bits. Put that together in some fashionand you'll get a unique ID that is globally unique within some hardwareconfiguration. Note that packets including this PEID 951 are routable.Just by looking at the PEID 951, the system 201 has a topologicalstructure so that it can route based on purely the PEID 951. The nextthing to keep in mind is that system 201 is managing multiple virtualcontext. Each VR 210 in a system 201 is a virtual router to which packetare to be directed. When packets come into node N 931 for example,system 201 needs to be able to steer it to the appropriate logicalentity, i.e., to the appropriate context and to the object channel thatit represents. Thus, a logical queue ID 952 is appended that is uniquewithin the destination processor (PE) 930. If an object in a processor930 on node 1 930 wants to set up a channel to another object aprocessor 930 on node N 930, they need to use the LQID 952. A first LQID952 and PEID 951 together represent the local end, and a second LQID 952and PEID 951 together represent the remote end of the object and so thesystem can map the corresponding object channel, defining the objectchannel that is going across the network. From a networking perspective,PEID 951 looks like your IP address that routes packets like an IPaddress. But once you go to a particular node 931, the LQID looks likethe UDP (User Datagram Protocol, a TCP/IP protocol describing howmessages reach programs within a destination computer) code number. Sosystem 201 (e.g., SMS 221) essentially signals and negotiates the properLQID to have a channel going between those ends. This allows all thetraffic coming into a PE 930 to be steered along the appropriate objectpath to the appropriate object channel on that object.

[0061] In some embodiments, an object could be talking on anotherchannel to another object, or to the same object, using a differentchannel. In which case each channel uses a different LQID 952, but thesame PEID 951.

[0062] In some embodiments, system 201 sets up a shortcut thatcircumvents traffic that otherwise would be transmitted outside system201 and then back in (e.g., traffic between two different VRs 210supporting different customers). To set up such a shortcut, system 201allocates a different LQID 952 for the shortcut. Thus, an object channelhas the normal point-to-point path for normal traffic and has amulti-point-to-point path which is used for shortcut traffic. So whenpackets come in to the object it knows whether the packet came in on thenormal path or on the shortcut path. Similarly, when the object wants touse a shortcut, it also needs to allocate a different LQID for itsoutbound shortcut traffic. One interesting distinction of shortcut pathsis that the normal point-to-point is bidirectional and data can flow inboth directions, but shortcuts data flow flows in only one direction. Soa receive site can have any number of transferred sites. Any number ofobjects can be transmitting to the same receive site. That is why it iscalled multi-point-to-point.

[0063] Further, some embodiments have different levels of shortcuts. Forexample, a packet can be sequentially passed to successive destinationsin some embodiments. Thus there can be a complex multistage path. Theshortcuts can trickle down to the ultimate end, where the packetcascades. Further, if one object knows a shortcut, it can tell otherobjects about its shortcut. So the other object does not have to come tothe first object and then be directed to the shortcut destination, butrather can directly use the shortcut it has learned about.

[0064] While service providers recognize the tremendous revenuepotential of managed firewall services, the cost of deploying, managingand maintaining such services via traditional CPE-based methods issomewhat daunting. Service providers are now seeking new servicedelivery mechanisms that minimize capital and operational costs whileenabling high-margin, value-added public network services that areeasily provisioned, managed, and repeated. Rolling out a network-basedmanaged firewall service is a promising means by which to accomplishthis. Deploying an IP Service Delivery Platform in the service providernetwork brings the intelligence of a managed firewall service out of thecustomer premises and into the service provider's realm of control.

[0065] An IP Service Delivery Platform consists of three distinctcomponents. The first is an intelligent, highly scalable IP ServiceProcessing Switch. Next is a comprehensive Service Management System(SMS) to enable rapid service provisioning and centralized systemmanagement. The last component is a powerful Customer Network Management(CNM) system which provides enterprise customers with detailed networkand service performance systems, enable self-provisioning, and eases ITmanagers fears of losing control of managed network services.

[0066] In a network-based managed firewall service model, the serviceprovider replaces the high-capacity access concentration router at thePOP with an IP Service Processing Switch. This is higher-capacity, morerobust, and more intelligent access switch, with scalable processing upto 100+ RISC CPUs. Just as with the access router, additional customeraccess capacity is added via installing additional port access blades tothe IP Service Processing Switch chassis. Unlike conventional accessrouters, however, additional processor blades are added to ensurewire-speed performance and service processing.

[0067] The intelligence resident in the IP Service Processing Switcheliminates the need to deploy CPE devices at each protected customersite. Deployment, configuration, and management of the managed firewallservice all take place between the IP Service Processing Switch 230 andits Service Management System 221, which resides on a high-end UNIXplatform at the service provider NOC. The customer also has the abilityto initiate service provisioning and augmentation via a web-basedCustomer Network Management tool that typically resides at thecustomer's headquarters site. This is an entirely different servicedelivery paradigm, requiring minimal or no truck rolls or on-siteintervention.

[0068] To roll out a managed network-based firewall service, the serviceprovider's security staff provides a consultation to the enterprise,thereby gaining an understanding of the corporate network infrastructureand developing appropriate security policies (this is a similar processto the CPE model). Once this has been accomplished, the NOC securitystaff remotely accesses the IP Service Processing Switch (using theService Management System 221) at the regional POP serving theenterprise customer, and the firewall service is provisioned andconfigured remotely.

[0069] This model enables the service provider to leverage theenterprise's existing services infrastructure (leased lines and FrameRelay PVCs) to deliver new, value-added services without the requirementof a truck roll. All firewall and VPN functionality resides on the IPService Processing Switch at the POP, thus freeing the service providerfrom onsite systems integration and configuration and effectively hidingthe technology from the enterprise customer. Firewall inspection andaccess control functions, as well as VPN tunneling and encryption, takeplace at the IP Service Processing Switch and across the WAN, while theenterprise's secure leased line or Frame Relay PVC (permanent virtualcircuit) access link remains in place. The customer interface is betweenits router and the IP Service Processing Switch (acting as an accessrouter), just as it was prior to the rollout of the managed firewallservice. Additionally, the customer has visibility into and control overits segment of the network via the CNM that typically resides at theheadquarters site. TABLE 1 Comparison Between CPE-based andNetwork-based Managed Firewall Turn-up Processes Process CPE-based ModelNetwork-based Model Service Security consultation to Securityconsultation to Preparation identify customer identify customerrequirements/policies requirements/policies CPE device(s) ordered CPEdevice(s) preconfigured CPE device(s) shipped to customer site ServiceRollout Security technician deployed Service provisioning to site(s) andpolicy OS/Firewall/VPN software configuration deployed loaded(server-based model) from NOC via Service Physical network integrationManagement System of device (SMS)—No truck roll needed Additional Repeatabove for each Add configuration Service additional service template toSMS and Deployment duplicate across all service points, provision withCNM—No truck roll Maintenance/ Technician on phone with Technician atPOP Support customer testing CPE and testing equipment technician at POPtesting equipment Maintain inventory of spare Order units/components inservice spares/replacement region from central vendor Ship spares tocustomer site repository—No truck as needed roll necessary Deploytechnician to Integrate replacement customer site to complete unitcomponent at POP repairs if necessary

[0070] The network-based firewall model also enables service providersto quickly and cost-effectively roll out managed firewall solutions atall enterprise customer sites. As a result, secure Internet access canbe provided to every site, eliminating the performance and complexityissues associated with backhauling Internet traffic across the WAN toand from a centralized secure access point.

[0071] As the IP Service Delivery Platform is designed to enablevalue-added public network services, it is a carrier-grade system thatis more robust and higher-capacity than traditional access routers, andan order of magnitude more scalable and manageable than CPE-basedsystems. The platform's Service Management System enables managedfirewall services, as well as a host of other managed network services,to be provisioned, configured, and managed with point-and-clicksimplicity, minimizing the need for expensive, highly skilled securityprofessionals and significantly cutting service rollout lead-times. TheService Management System is capable of supporting a fleet of IP ServiceProcessing Switches and tens of thousands of enterprise networks, andinterfaces to the platform at the POP from the NOC via IP address.Support for incremental additional platforms and customers is added viamodular software add-ons. Services can be provisioned via the SMSsystem's simple point and click menus, as well as requested directly bythe customer via the CNM system.

[0072] Deployment of a robust IP Service Delivery Platform in thecarrier network enables service providers to rapidly turn-up high value,managed network-based services at a fraction of the capital andoperational costs of CPE-based solutions. This enables service providersto gain a least-cost service delivery and support structure.Additionally, it enables them to gain higher margins and more marketshare than competitors utilizing traditional service deliverymechanisms—even while offering managed firewall services at a lowercustomer price point.

[0073] The following embodiments explore four specific managed firewallservice delivery architectures usable by service providers, systemsintegrators, and hardware/software vendors.

[0074] CPE-Based Models

[0075] Architecture One: Check Point/Nokia Appliance

[0076] This architecture employs a firewall/VPN CPE appliance,traditional access router, and software-based centralized managementsystem to deliver a managed firewall solution. The specific componentsof this solution include:

[0077] 1. Check Point/Nokia VPN-1/IP-330 appliance (50 user license) atbranch sites

[0078] 2. Check Point VPN-1/Firewall-1 software module (unlimited userlicense) on Sun Enterprise Ultra 250 server platform at headquarters

[0079] 3. Cisco 7513 access router at the service provider's POP(redundant power, redundant RSP4)

[0080] 4. Check Point Provider-1 management system at the serviceprovider's NOC (supports 50 customers/module) with unlimitedsites/customer on Sun Ultra 60 platform at Network Operations Center(NOC)

[0081]FIG. 10 shows a block diagram of a system 1000 providing a ManagedFirewall Service with a CheckPoint/Nokia Appliance Solution.

[0082] Architecture Two: Check Point Server

[0083] This architecture employs a firewall/VPN CPE server, traditionalaccess router, and software-based centralized management system todeliver a managed firewall solution. The specific components of thissolution include:

[0084] 5. Check Point VPN-1/Firewall-1 software module (50 user license)on Sun 5S server platform at branch sites

[0085] 6. Check Point VPN-1/Firewall-1 software module (unlimited userlicense) on Sun Enterprise Ultra 250 server platform at headquarters

[0086] 7. Cisco 7513 access router at the service provider POP(redundant power, redundant RSP4)

[0087] 8. Check Point Provider-1 management system (supports 50customers/module) with unlimited sites/customer on Sun Ultra 60 platformat NOC

[0088]FIG. 11 shows a block diagram of a system 1100, providing aManaged Firewall Service with a CheckPoint Firewall-1 Server-basedSolution.

[0089] Architecture Three: WatchGuard Appliance Model

[0090] This architecture employs a firewall/VPN CPE appliance,traditional access router, and software-based centralized managementsystem to deliver a managed firewall solution. The specific componentsof this solution include:

[0091] 9. WatchGuard Firebox II Plus appliance at branch sites

[0092] 10. Cisco 7513 access router at the service provider POP(redundant power, redundant RSP4)

[0093] 11. WatchGuard for MSS management system (supports 500customers/module) with unlimited sites/customer on Compaq Proliant 3000Windows NT workstation platform, Event Processor on Sun Microsystems 5Sserver platform

[0094]FIG. 12 shows a block diagram of a system 1200, providing aManaged Firewall Service with a WatchGuard Appliance Solution. TheCPE-based managed firewall service model requires installation andconfiguration of system components at three network points: the serviceprovider POP, the service provider NOC, and the customer premises.

[0095] POP Infrastructure

[0096] Each of the three CPE-based architectures explored in thisanalysis employs an identical POP infrastructure. This accessinfrastructure is based on the Cisco 7513 router. The base configurationfor the 7513 includes:

[0097] 12. 13-slot chassis

[0098] 13. IOS Service Provider system software

[0099] 14. (2) power supplies

[0100] 15. (2) Route Switch Processors (RSP4)

[0101] 16. (2) RSP4 128 MB DRAM Option

[0102] 17. (2) RSP4 20 MB Flash Card Option

[0103] 18. 2-port Fast Ethernet Card

[0104] 19. 64 MB DRAM Option

[0105] 20. 8 MB SRAM Option

[0106] The RSP4 cards in this base configuration each consume one slotin the chassis, leaving 11 remaining for port adapters. An Ethernet cardis added for software uploads. Ingress traffic is supported viadual-port channelized and/or dual-port unchannelized T3 cards (fordedicated T3 connections). Each channelized T3 port can support up to128 DSO or N×T1 channels Single-port OC-3 POS cards provide connectivityto the network uplink on the egress side. These cards each occupy asingle slot. Each card requires a programmable Versatile InterfaceProcessor (VIP2), as well as an additional 64 MB of DRAM and 8 MB ofSRAM. The VIP2 and additional memory reside on the T3/OC-3 cards and donot consume additional slots.

[0107] As described in the assumptions, a traditional multiplexer existsat each POP to aggregate various sub-T1 customer access links up to thechannelized T3 interfaces on the Cisco 7513 router. As the POPinfrastructure installation and configuration processes are uniformacross all managed firewall service models explored in this analysis,the costs associated with these processes will not be quantified.

[0108] Network-Based Model of the Present Invention—Architecture Four

[0109] IP Service Delivery Platform 300 that includes an IP ServiceProcessing Switch (IPSX 230), a Service Management System (SMS 221) anda Customer Network Management System (CNMS 222).

[0110] This architecture employs an IP Service Processing Switch and asoftware-based centralized SMS to deliver a managed firewall solution.The specific components of this solution include:

[0111] 21. IPSX 230 (IP Service Processing Switch) at service providerPOP

[0112] 22. Service Management System 221 on Sun Ultra 60 server atservice provider NOC

[0113] 23. InGage™ Customer Network Management System at thesubscriber's headquarters

[0114]FIG. 13 shows a block diagram of a system 1300 that provides aManaged Firewall Service with CoSine's Network-based Solution of thepresent invention.

[0115]FIG. 14 shows a block diagram of one embodiment of the presentinvention, system 1400. System 1400 includes a first processing system1410 and a second processing system 1420, each of which, in someembodiments, has a plurality of processors such that they can beincrementally expanded. In some embodiments, one or both of the firstand second processing systems includes one or more control processors,one or more access processors, and one or more processing processors, asdescribed above. In such systems, packets will be transmitted both ways,but for simplicity of explanation, packets transmitted from system 1410to 1420 are explained. The same explanation can be applied to packetsgoing the other direction. System 1410 includes a source of data packets1401, and system 1420 has the destination 1402 for these packets. Insome embodiments, one or more virtual routers 1411 (and possibly 1412and 1413) are provided in system 1410, wherein a separate virtual routercan be assigned to each of a plurality of different customers. Thus eachcustomer views the system 1410 has having only its router (e.g., virtualrouter 1411 for a first customer, virtual router 1412 for a secondcustomer, etc.) and each customer does not “see” the other virtualrouters for the other customers. These other customers would have otherpacket sources (not shown) to supply packets to their virtual routers.Similarly, in some embodiments, system 1420 includes one or more virtualrouters 1421 (and possibly 1422 and 1423), wherein a separate virtualrouter can be assigned to each of a plurality of different customers.Thus each customer views the system 1420 has having only its one router(e.g., virtual router 1421 for the first customer, virtual router 1422for another customer, etc.) and each customer does not “see” the othervirtual routers for the other customers. The IP SEC mode provides thateach transmitting virtual router examines each packet (e.g., by theencrypt-bit detection block 1414) being sent to see if it is to beencrypted or not (e.g., by examining a bit in the packet), and if sopasses the packet to encryptor 1415, which encrypts the packet using asuitable encryption method (many of which are known in the art, such asstandard public-key/private-key IP encryption). The virtual router 1411would then route the encrypted packet to virtual router 1421. Sinceencryption takes time, router 1411 typically will not encrypt everypacket, but will instead examine each packet to determine whether toencrypt or not. Similarly, virtual router 1421 will examine eachincoming packet using decrypt-detection block 1424 being received to seeif it is to be decrypted or not (e.g., by examining a bit in thepacket), and if so passes the packet to decryptor 1425, which decryptsthe packet using a suitable decryption method corresponding to theencryption method of encryptor 1415. The decrypted packets are thenrouted to the packet destination 1402. As is typical for internet packettransmission, there may be any number of other intermediate nodes (notshown) between router 1411 and router 1421, wherein packets are receivedand sent on towards their destination by each intermediate router alongthe way. If a virtual private network (VPN) is desired between packetsource 1401 and packet destination 1402, (e.g., by forming a tunnel forthe packets) then every packet is parked as requiring encryption anddecryption for as long as the connection is maintained. In someembodiments, the detection of whether to encrypt or not, as describedjust above, is thus redundant. However, other virtual routers (e.g.,1412 and 1413) may desire to send packets that are not to be encrypted,and thus each virtual router 1411, 1412, and 1413 are configured to testeach outgoing packet, and each virtual router 1421, 1422, and 1423 areconfigured to test each ingoing packet, to determine whether or not toencrypt or decrypt.

[0116]FIG. 15 shows a block diagram of another embodiment of the presentinvention, system 1500. A first processing system 1510 includes one ormore virtual routers 1511, 1512, and 1513, and a second first processingsystem 1520 includes one or more virtual routers 1521, 1522, and 1523.In some embodiments, at least one of the virtual routers 1511 does notexamine each packet (i.e., to determine whether or not to encrypt), butinstead is set up as part of a tunnel, wherein all tunnel traffic isencrypted. Thus all traffic going out of virtual router 1511 goest toencryptor router (or node) 1515, which encrypts all of its traffic andthen routes those encrypted packets onto the internet, destined fordecryptor router (or node) 1525. There, all traffic is decrypted(without needing to examine each packet to determine whether or not todecrypt), and then routed to the appropriate one of virtual routers1521, 1522, or 1523. Traffic to virtual router 1521 is then sent topacket destination 1402. Thus, in system 1500, the setting up of thetunnel across the internet between he packet source 1401 and the packetdestination 1402 includes a sending virtual router 1511 which need notexamine every packet, but instead inserts the encryption node or router1515 into the path for every packet. The encryption node 1515 simplybecomes one more node along the path between the source 1401 and thedestination 1402. Each virtual router 1511 to 1513 can share the sameencryption node 1515 if it is set up to be sending tunnel traffic. Thosenodes not sending tunnel traffic can simply bypass the encryption node1515 (and those virtual routers 1513 can, in some embodiments, examineeach packet as described above to determine whether or not to encrypt,or can simply assume that all its traffic is not to be encrypted). Thissimplification also applies to the decryption side in system 1520.

[0117] POP Infrastructure

[0118] The POP access infrastructure in the network-based managedfirewall service model is based on the CoSine Communications IPSX 9000Service Processing Switch. The base configuration for the switchincludes:

[0119] 24. 26-slot chassis

[0120] 25. Redundant power supply

[0121] 26. IPNOS Base Software

[0122] 27. Ring Bridge & Ring Bridge Pass-Thru (to complete midplane)

[0123] 28. Control Blade (for communications with Invision ServicesManagement System)

[0124] 29. Dual-port Channelized DS3 Access Blade

[0125] 30. Dual-port Unchannelized DS3 Access Blades

[0126] 31. Processor Blade

[0127] 32. OC-3c POS Trunk Blade

[0128] Analysis

[0129] Analysis of the four service delivery architectures for deployinga managed firewall service reveals extremely compelling data in favor ofimplementing the network-based model based on the CoSine CommunicationsIP Service Delivery Platform. Significant advantages are gained byutilizing this model in each of the following areas:

[0130] Operational “Soft” Costs

[0131] The network-based managed firewall solution eliminates most ofthe steep operational costs that are associated with deploying aCPE-based solution, specifically the per site truck roll and deviceinstallation charges. The CheckPoint server-based CPE deployment andinstallation operational costs alone exceed the total five-year capitalequipment investment required in the CoSine Communications network-basedmodel. Though the installation and configuration costs for the POP andNOC build-outs are not quantified in this study due to the uniformity ofthese processes across all solutions, it is worthy to note that thegreater capacity of the CoSine IPSX 9000 Service Processing Switch andInvision Service Management System result in fewer components (switchchassis, NOC servers and software) that need to be installed andconfigured.

[0132] Time to Market, Time to Revenue

[0133] The network-based managed firewall solution enables serviceproviders to greatly shorten the lead-time required to deploy themanaged firewall service. The removal of the CPE component from theservice offering eliminates the need to procure the device, eliminatinga delay in service rollout. This also eliminates the delay that isassociated with scheduling an onsite installation.

[0134] Complexity

[0135] The network-based managed firewall solution greatly reduces thecomplexity associated with deploying the service. The number ofdistributed devices is reduced from thousands of remote customer sitesto only a few already staffed POPs, simplifying management andmaintenance significantly.

[0136] The network-based managed firewall service model creates a newsource of revenue for service providers that is scalable, repeatable,and cost-effective. Leveraging centrally-managed services enablesservice providers to derive greater value from the existing basic accessinfrastructure. The network-based model eliminates expensive onsiteinstallation and maintenance required of CPE-based solutions, andprovides a foundation to deploy additional value-added services via thesame delivery mechanism. Elimination of the CPE device also effectivelyhides the technology of the managed firewall solution from the customer,reducing internal network complexity and technical anxiety.

[0137] One aspect of the present invention provides a method of packetrouting. The method includes connecting a plurality of processors in anetwork, assigning a unique processor identifier (PEID) to each of theprocessors, routing a first packet to a first one of the processorsacross the network, wherein each such packet includes a PEID valuecorresponding to a PEID of one of the processors, and wherein therouting to the first processor is based on the PEID value in the firstpacket, establishing a plurality of objects in the first processor,assigning a logical queue identifier (LQID) to a first one of theobjects in the first processor, wherein each packet also includes anLQID value corresponding to an LQID of one of the objects, and routingthe first packet to the first object based on the LQID value in thefirst packet.

[0138] Some embodiments further include assigning a plurality ofdifferent LQIDs to the first object.

[0139] Some embodiments further include routing a plurality of packets,each having a different LQID, to the first object based on the LQIDvalue in each respective packet.

[0140] In some embodiments, the first object is associated with avirtual router (VR).

[0141] Some embodiments further include establishing the first LQID withthe first object to be used for point-to-point data traffic, andestablishing a second LQID with the first object to be used for shortcutdata traffic.

[0142] In some embodiments, the network is configured in a ringtopology.

[0143] Another aspect of the present invention provides a system forrouting packets. This system includes a plurality of processors coupledto one another using a network, wherein each of the processors a uniqueprocessor identifier (PEID), wherein a first packet is routed into afirst one of the processors across the network, wherein each such packetincludes a PEID value corresponding to a PEID of one of the processors,and wherein the routing to the first processor is based on the PEIDvalue in the first packet, a plurality of objects in the firstprocessor, wherein each such object is assigned a logical queueidentifier (LQID), wherein each packet also includes an LQID valuecorresponding to an LQID of one of the objects, and software for routingthe first packet to the first object based on the LQID value in thefirst packet.

[0144] In some embodiments, a plurality of different LQIDs aresimultaneously assigned to the first object.

[0145] In some embodiments, the means for routing includes means forrouting a plurality of packets, each having a different LQID, to thefirst object based on the LQID value in each respective packet.

[0146] In some embodiments, the first object is associated with avirtual router (VR).

[0147] In some embodiments, the first LQID is associated with the firstobject to be used for point-to-point data traffic, and a second LQID isassociated with the first object to be used for shortcut data traffic.

[0148] In some embodiments, the network is configured in a ringtopology.

[0149] Still another aspect of the present invention provides a systemfor routing packets. This system includes a plurality of processorscoupled to one another using a network, wherein each of the processors aunique processor identifier (PEID), wherein a first packet is routedinto a first one of the processors across the network, wherein each suchpacket includes a PEID value corresponding to a PEID of one of theprocessors, and wherein the routing to the first processor is based onthe PEID value in the first packet, and a plurality of objects in thefirst processor, wherein each such object is assigned a logical queueidentifier (LQID), wherein each packet also includes an LQID valuecorresponding to an LQID of one of the objects, wherein the first packetis routed to the first object based on the LQID value in the firstpacket.

[0150] Some embodiments further include a services management systemthat provides changeable provisioning of processor capacity among aplurality of customers.

[0151] Some embodiments further include a services management systemthat provides firewall protection for each of a plurality of customers.

[0152] The network-based managed firewall service model creates a newsource of revenue for service providers that is scalable, repeatable,and cost-effective. Leveraging centrally-managed services enablesservice providers to derive greater value from the existing basic accessinfrastructure. The network-based model eliminates expensive onsiteinstallation and maintenance required of CPE-based solutions, andprovides a foundation to deploy additional value-added services via thesame delivery mechanism. Elimination of the CPE device also effectivelyhides the technology of the managed firewall solution from the customer,reducing internal network complexity and technical anxiety.

[0153] The CoSine Communications IP Service Delivery Platform 300enables service providers to reap the benefits of deploying anetwork-based managed firewall service. The IPSX 9000 Service ProcessingSwitch is a robust, high-availability platform that is capable ofsupporting hundreds of customer sites and network-based firewalls. TheInVision Services Management System is capable of rapidly provisioningand managing thousands of managed firewall customers throughout anextensive nationwide network, enabling service providers to leveragevolume security services driven by fewer staff resources. And theInGage™ Customer Network Management System empowers customer IT managersto view and augment managed network services. The IP Service DeliveryPlatform positions service providers to continuously deploy newvalue-added services to their customer base, maximizing revenues andcreating customer lock-in.

[0154] Service providers utilizing the IP Service Delivery Platform 300are to gain a significant competitive edge in deploying high-valueIP-based services. The CoSine Communications solution enables servicesproviders to save on the capital costs associated with deploying amanaged firewall service over traditional CPE-based approaches.Additionally, the CoSine solution of the present invention virtuallyeliminates the steep operational “soft” costs that plague the CPEapproach. Furthermore, as customer numbers and bandwidth requirementsincrease over time, so do the cost savings. This enables serviceproviders to gain a cost-leadership position while greatly increasingrevenues.

[0155] The IP Service Delivery Platform (IPSDP 300) is an ideal solutionfor service providers seeking to offer high value managed, network-basedfirewall services.

[0156] In some embodiments, a set of one or more management consultantsto the networking industry help equipment vendors, service providers andenterprises make strategic decisions, mitigate risk and affect changethrough business and technology consulting engagements. This approach istailored to each client's specific issues, objectives and budget.

[0157] These consultants are leaders in the networking industry andinfluence its direction though confidential engagements for industryleaders and through public appearances and trade magazine articles.These interactions assure clients that they will be among the first toknow of the latest industry concepts and emerging technology trends.

[0158] Each consulting engagement is uniquely structured-no forcedmethodologies or canned reports are employed. An integratedclient/management consultant case team respecting and soliciting theopinions of everyone is formed for each engagement.

[0159] The present invention provides a flexible, scalable hardware andsoftware platform that allows a service provider to easily provideinternet services, virtual private network services, firewall services,etc., to a plurality of customers. This solution can be changes toprovision each customer with more or less processing power and storage,according to individual changing needs.

[0160] One aspect of the present invention provides a method ofdelivering security services. This method includes connecting aplurality of processors 930 in a ring configuration within a firstprocessing system, establishing a secure connection between theprocessors in the ring configuration across an internet protocol (IP)connection to a second processing system to form a tunnel, and providingboth router services and host services for a customer using theplurality of processors in the ring configuration and using the secondprocessing system.

[0161] In some embodiments, one or more processors In some embodiments,to support a communications network, the plurality of processorsincludes one or more control processors, one or more access processors,and one or more processing processors.

[0162] In some embodiments, for each of a plurality of customers, avirtual router 210 is formed in the first processing system 401 and isoperably connected to a virtual router 210 formed in the second system402.

[0163] In some embodiments, for each of a plurality of customers, avirtual private network 410 is formed using a virtual router 210 formedin the first processing system 401 and operably connected to a virtualrouter 210 formed in the second system 402.

[0164] In some embodiments, the connecting a plurality of processors inthe ring configuration includes forming dual counter rotating ringconnections 933 and 934, each connecting to each of the plurality ofprocessors 930.

[0165] Another aspect of the present invention provides a system ofdelivering security services. This system 201 includes a plurality ofprocessors 230 in a ring configuration within a first processing system401, and means for establishing a secure connection 418 between theprocessors in the ring configuration 411 across an internet protocol(IP) connection to a second processing system 412 to form a tunnel, andfor providing both router services and host services for a customerusing the plurality of processors in the ring configuration 411 andusing the second processing system 412.

[0166] In some embodiments, to support a communications network, theplurality of processors includes one or more control processors, one ormore access processors, and one or more processing processors.

[0167] In some embodiments, for each of a plurality of customers, avirtual router is formed in the first processing system and is operablyconnected to a virtual router formed in the second system.

[0168] In some embodiments of this system, for each of a plurality ofcustomers, a virtual private network is formed using a virtual routerformed in the first processing system and operably connected to avirtual router formed in the second system.

[0169] In some embodiments of this system, the plurality of processorsin the ring configuration includes dual counter rotating ringconnections, each connecting to each of the plurality of processors.

[0170] Yet another aspect of the present invention provides a system 201for delivering security services. This second system 201 includes aplurality of processors within a first processing system connected in aring configuration, and a tunnel formed using a secure connectionbetween the processors in the ring configuration across an internetprotocol (IP) connection to a second processing system, wherein bothrouter services and host services are provided for a customer using theplurality of processors in the ring configuration and using the secondprocessing system.

[0171] In some embodiments of this second system, to support acommunications network, the plurality of processors 930 includes one ormore control processors 234, one or more access processors 238, and oneor more processing processors 236. In some embodiments, one or more ofthese processors is packaged on a blade 239.

[0172] In some embodiments of this second system, for each of aplurality of customers, a virtual router 210 is formed in the firstprocessing system 401 and is operably connected to a virtual router 210formed in the second system 402.

[0173] In some embodiments of this second system, for each of aplurality of customers, a virtual private network 410 is formed using avirtual router 210 formed in the first processing system 401 andoperably connected to a virtual router 210 formed in the second system410.

[0174] In some embodiments of this second system, the plurality ofprocessors 230 in the ring configuration includes dual counter rotatingring connections 932 and 933, each connecting to each of the pluralityof processors 930.

[0175] Some embodiments of this second system further include a servicesmanagement system 221 that provides changeable provisioning of processorcapacity among a plurality of customers.

[0176] Some embodiments of this second system further include a servicesmanagement system 221 that provides firewall protection for each of aplurality of customers.

[0177] Some embodiments of this second system further include a servicesmanagement system 221 that provides provisioning of processor capacityamong a plurality of customers, wherein each customer's resources areisolated from those of all the other customers.

[0178] Another aspect of the present invention provides a method ofdelivering security services, for example by forming a secure tunnelbetween a source site and a destination site. The method includesestablishing a first routing node within a first processing system,establishing a second routing node within a second processing system,establishing a first internet protocol (IP) connection communicationspath between the first processing system and the second processingsystem that includes the first routing node and the second routing node,receiving a plurality of data packets into the first routing node,encrypting all of the received packets, without regard to any indicationin the received packets, to form encrypted packets, sending theencrypted packets from the first routing node to the second routingnode, receiving the encrypted packets into the second routing node,decrypting all of the received encrypted packets, without regard to anyindication in the received encrypted packets, to form decrypted packets,and sending the decrypted packets from the second routing node to adestination in the second processing system.

[0179] In some embodiments, to support a communications network, thefirst processing system includes one or more control processors, one ormore access processors, and one or more processing processors.

[0180] In some embodiments, for a first customer, a virtual router formsthe first routing node in the first processing system and is operablyconnected to a virtual router that forms the second routing node in thesecond processing system.

[0181] In some embodiments, for each of a plurality of customers, avirtual private network is formed using a virtual encrypting routerformed in the first processing system and operably connected to avirtual decrypting router formed in the second processing system.

[0182] In some embodiments, establishing the first routing node in thefirst processing system includes connecting a plurality of processors ina ring configuration.

[0183] In some embodiments, the connecting the plurality of processorscomprises connecting the plurality of processors in a ringconfiguration, and wherein the connecting a plurality of processors inthe ring configuration includes forming dual counter rotating ringconnections, each connecting to each of the plurality of processors.

[0184] Yet another aspect of the present invention provides a system ofdelivering security services. This system includes a first processingsystem, a second processing system, and means for establishing a secureconnection between the processors across an internet protocol (IP)connection to a second processing system to form a tunnel, wherein thesecure connection encrypts all packets going into the tunnel anddecrypts all packets coming from the tunnel.

[0185] In some embodiments, to support a communications network, thefirst processing system includes one or more control processors, one ormore access processors, and one or more processing processors.

[0186] In some embodiments, for each of a plurality of customers, avirtual router is formed in the first processing system and is operablyconnected to a virtual router formed in the second system.

[0187] In some embodiments, for each of a plurality of customers, avirtual private network is formed using an encrypting virtual routerformed in the first processing system and operably connected to adecrypting virtual router formed in the second system.

[0188] In some embodiments, the one or more control processors, the oneor more access processors, and the one or more processing processors areconnected by dual counter-rotating ring connections, each connecting toeach of the plurality of processors.

[0189] Still another aspect of the present invention provides a system1500 of delivering security services, This system includes a firstprocessing system 1510, a second processing system 1520, and a firstrouting node 1515 within the first processing system, and a secondrouting node 1525 within the second processing system, wherein the firstrouting node 1515 encrypts all packets routed to it and forwardsencrypted packets to the second routing node 1525, and the secondrouting node 1525 decrypts the encrypted packets sent from the firstrouting node and sends the decrypted packets from the second routingnode to a destination 1402 in the second processing system 1520.

[0190] In some embodiments of system 1500, to support a communicationsnetwork, the first processing system includes one or more controlprocessors, one or more access processors, and one or more processingprocessors.

[0191] In some embodiments of system 1500, for each of a plurality ofcustomers, an encrypting virtual router 1511 is formed in the firstprocessing system 1510 and is operably connected to a decrypting virtualrouter 1521 formed in the second processing system 1520.

[0192] In some embodiments of system 1500, for each of a plurality ofcustomers, a virtual private network is formed using an encryptingvirtual router formed in the first processing system and operablyconnected to a decrypting virtual router formed in the second system.

[0193] Some embodiments of system 1500 include one or more controlprocessors, one or more access processors, and one or more processingprocessors connected in a ring configuration that includes dual counterrotating ring connections, each connecting to each of these plurality ofprocessors.

[0194] Some embodiments further include a first virtual router in thefirst processing system that receives packets to be sent and routes suchpackets to the first routing node for encryption. Some embodimentsfurther include a second virtual router in the second processing systemthat receives packets from the second routing node after decryption androutes such packets towards a destination.

[0195] It is understood that the above description is intended to beillustrative, and not restrictive. Many other embodiments will beapparent to those of skill in the art upon reviewing the abovedescription. The scope of the invention should, therefore, be determinedwith reference to the appended claims, along with the full scope ofequivalents to which such claims are entitled.

What is claimed is:
 1. A method of delivering security services,comprising: establishing a first routing node within a first processingsystem; establishing a second routing node within a second processingsystem; establishing a first internet protocol (IP) connectioncommunications path between the first processing system and the secondprocessing system that includes the first routing node and the secondrouting node; receiving a plurality of data packets into the firstrouting node; encrypting all of the received packets, without regard toany indication in the received packets, to form encrypted packets;sending the encrypted packets from the first routing node to the secondrouting node; receiving the encrypted packets into the second routingnode; decrypting all of the received encrypted packets, without regardto any indication in the received encrypted packets, to form decryptedpackets; and sending the decrypted packets from the second routing nodeto a destination in the second processing system.
 2. The method of claim1, wherein, to support a communications network, the first processingsystem includes one or more control processors, one or more accessprocessors, and one or more processing processors.
 3. The method ofclaim 1, wherein for a first customer, a virtual router forms the firstrouting node in the first processing system and is operably connected toa virtual router that forms the second routing node in the secondprocessing system.
 4. The method of claim 1, wherein for each of aplurality of customers, a virtual private network is formed using avirtual encrypting router formed in the first processing system andoperably connected to a virtual decrypting router formed in the secondprocessing system.
 5. The method of claim 1, wherein the establishingthe first routing node in the first processing system includesconnecting a plurality of processors in a ring configuration.
 6. Themethod of claim 5, wherein the connecting the plurality of processorscomprises connecting the plurality of processors in a ringconfiguration, and wherein the connecting a plurality of processors inthe ring configuration includes forming dual counter rotating ringconnections, each connecting to each of the plurality of processors. 7.A system of delivering security services, comprising: a first processingsystem; a second processing system; and means for establishing a secureconnection between the processors across an internet protocol (IP)connection to a second processing system to form a tunnel, wherein thesecure connection encrypts all packets going into the tunnel anddecrypts all packets coming from the tunnel.
 8. The system of claim 7,wherein, to support a communications network, the first processingsystem includes one or more control processors, one or more accessprocessors, and one or more processing processors.
 9. The system ofclaim 7, wherein for each of a plurality of customers, a virtual routeris formed in the first processing system and is operably connected to avirtual router formed in the second system.
 10. The system of claim 7,wherein for each of a plurality of customers, a virtual private networkis formed using an encrypting virtual router formed in the firstprocessing system and operably connected to a decrypting virtual routerformed in the second system.
 11. The system of claim 8, wherein the oneor more control processors, the one or more access processors, and theone or more processing processors are connected by dual counter-rotatingring connections, each connecting to each of the plurality ofprocessors.
 12. A system of delivering security services, comprising: afirst processing system; a second processing system; a first routingnode within the first processing system; and a second routing nodewithin the second processing system; wherein the first routing nodeencrypts all packets routed to it and forwards encrypted packets to thesecond routing node, and the second routing node decrypts the encryptedpackets sent from the first routing node and sends the decrypted packetsfrom the second routing node to a destination in the second processingsystem. 13 The system of claim 12 wherein, to support a communicationsnetwork, the first processing system includes one or more controlprocessors, one or more access processors, and one or more processingprocessors. 14 The system of claim 12 wherein for each of a plurality ofcustomers, an encrypting virtual router is formed in the firstprocessing system and is operably connected to a decrypting virtualrouter formed in the second system. 15 The system of claim 12 whereinfor each of a plurality of customers, a virtual private network isformed using an encrypting virtual router formed in the first processingsystem and operably connected to a decrypting virtual router formed inthe second system.
 16. The system of claim 13, wherein the one or morecontrol processors, the one or more access processors, and the one ormore processing processors are connected in a ring configuration thatincludes dual counter rotating ring connections, each connecting to eachof the first plurality of processors.
 17. The system of claim 12,further comprising: a first virtual router in the first processingsystem that receives packets to be sent and routes such packets to thefirst routing node for encryption.
 18. The system of claim 12, furthercomprising: a first virtual router in the first processing system thatreceives packets to be sent and routes such packets to the first routingnode for encryption; and a second virtual router in the secondprocessing system that receives packets from the second routing nodeafter decryption and routes such packets towards a destination.
 19. Thesystem of claim 12, further comprising: a second virtual router in thesecond processing system that receives packets from the second routingnode after decryption and routes such packets towards a destination.